A new attack chain against N-able’s N-central remote monitoring and management (RMM) platform has revealed how an unauthenticated attacker can escalate from a weak legacy authentication mechanism to a full compromise of managed environments. The vulnerability allows threat actors to access domain credentials, SSH keys, and API tokens, potentially affecting thousands of servers.
Researchers at Horizon3.ai revisited earlier N-central vulnerabilities that had previously landed in CISA’s Known Exploited Vulnerabilities catalog, specifically examining authenticated issues in deserialization and command execution. During this analysis, they identified two additional flaws in the legacy SOAP API: CVE-2025-9316, an authentication bypass via a weak session ID mechanism, and CVE-2025-11700, an XML External Entity (XXE) injection vulnerability. Together, these flaws enable an attacker with only network access to obtain valid session IDs and perform arbitrary file reads on the N-central appliance.
By targeting the appliance’s backup files, an attacker can extract the entire encrypted database along with keystore material and master passwords. Because cryptographic keys and configuration secrets are stored alongside the backups, the researchers demonstrated that an adversary could decrypt stored credentials and tokens. This exposure includes Windows domain credentials, N-central API keys, API keys for integrated services, and SSH private keys. The result is effectively handing over the keys to every environment managed by that N-central instance. From there, attackers could pivot laterally into customer networks, deploy implants, or exfiltrate data at scale.
N-able addressed CVE-2025-9316 and CVE-2025-11700 in N-central version 2025.4.0.9, which was released on November 5, 2025. The fix restricts access to the vulnerable SOAP endpoints by default and hardens the XML parser. Despite the patch availability, security researchers estimate that roughly 3,000 N-central appliances remain exposed to the internet, many of which are likely unpatched managed service provider deployments.
National cyber agencies, including Belgium’s Centre for Cybersecurity and Canada’s Cyber Centre, have published advisories urging organizations to upgrade N-central immediately. They advise administrators to remove direct internet exposure where possible and review logs for indicators of XXE exploitation. Suspicious entries may include failed import operations or XML parsing errors referencing external DTDs, which can signal attempts to pull sensitive files via XXE. For CISOs, the immediate concern involves the blast radius of the vulnerability, as a compromise is not just a single-server issue but a potential multi-tenant incident requiring credential rotation and log validation.
Sources: Horizon3.ai, Cyber Security News, N-able Documentation
—
By Ji-seo Kim
